veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode 8<--- cut here --- Unable to handle kernel paging request at virtual address 74756f78 when read [74756f78] *pgd=80000080005003, *pmd=00000000 Internal error: Oops: 206 [#1] SMP ARM Modules linked in: CPU: 1 UID: 0 PID: 3143 Comm: kworker/u8:2 Not tainted 6.15.0-rc5-syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express Workqueue: netns cleanup_net PC is at __rb_change_child include/linux/rbtree_augmented.h:199 [inline] PC is at __rb_erase_augmented include/linux/rbtree_augmented.h:242 [inline] PC is at rb_erase+0x270/0x394 lib/rbtree.c:443 LR is at 0x0 pc : [<81a3fb58>] lr : [<00000000>] psr: 200f0013 sp : df9e5d80 ip : 74756f70 fp : df9e5d94 r10: 82c1f980 r9 : 829d1ec4 r8 : 00000004 r7 : 838d8b00 r6 : 00000001 r5 : 8517c348 r4 : 8517c300 r3 : 74756f72 r2 : 00000000 r1 : 838d8b34 r0 : 8517c368 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 850515c0 DAC: 00000000 Register r0 information: slab kmalloc-128 start 8517c300 pointer offset 104 size 128 Register r1 information: slab kmalloc-128 start 838d8b00 pointer offset 52 size 128 Register r2 information: NULL pointer Register r3 information: non-paged memory Register r4 information: slab kmalloc-128 start 8517c300 pointer offset 0 size 128 Register r5 information: slab kmalloc-128 start 8517c300 pointer offset 72 size 128 Register r6 information: non-paged memory Register r7 information: slab kmalloc-128 start 838d8b00 pointer offset 0 size 128 Register r8 information: non-paged memory Register r9 information: non-slab/vmalloc memory Register r10 information: non-slab/vmalloc memory Register r11 information: 2-page vmalloc region starting at 0xdf9e4000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2844 Register r12 information: non-paged memory Process kworker/u8:2 (pid: 3143, stack limit = 0xdf9e4000) Stack: (0xdf9e5d80 to 0xdf9e6000) 5d80: 8517c300 8517c348 df9e5dd4 df9e5d98 80610d54 81a3f8f4 0000000c 600f0013 5da0: ddde099c 600f0013 00000000 03710a8b 8517cb00 84813a00 8517cb00 00000001 5dc0: 8517c300 00000004 df9e5e14 df9e5dd8 80610d88 80610c90 816f4260 829d1ec4 5de0: 829d1ec4 82aca2a8 df9e5e90 03710a8b df9e5e14 84813a00 df9e5e90 829e0224 5e00: df9e5e90 829d1ec4 df9e5e2c df9e5e18 80610e58 80610c90 8517cb00 df9e5e90 5e20: df9e5e3c df9e5e30 81980b1c 80610e3c df9e5e54 df9e5e40 816f45b0 81980b18 5e40: 84951b00 df9e5e90 df9e5e74 df9e5e58 81539cdc 816f45a4 829e0224 82c1f940 5e60: 829d1e80 df9e5e90 df9e5ed4 df9e5e78 8153c160 81539ca8 81a5bd14 8029ce24 5e80: 82c1f940 829d1e80 808c99b0 81539d04 84951b20 84951b20 00000100 00000122 5ea0: 00000000 03710a8b 81c01f84 83b83d80 829d1e98 8301bc00 8300e600 84186000 5ec0: 8301bc15 8300f070 df9e5f2c df9e5ed8 802873bc 8153bebc 81c01a44 84186000 5ee0: df9e5f14 df9e5ef0 829d1e9c 829d1e98 829d1e9c 829d1e98 df9e5f2c 00000000 5f00: 80282cf8 83b83d80 8300e620 8300e600 82804d40 83b83dac 84186000 61c88647 5f20: df9e5f6c df9e5f30 80288004 80287214 81a5bd14 8029ce24 df9e5f6c df9e5f48 5f40: 8028eb98 00000001 84186000 83b83e00 e4935e60 80287e08 83b83d80 00000000 5f60: df9e5fac df9e5f70 8028f07c 80287e14 80274ea8 81a5bc9c 84186000 03710a8b 5f80: df9e5fac 84986300 8028ef50 00000000 00000000 00000000 00000000 00000000 5fa0: 00000000 df9e5fb0 80200114 8028ef5c 00000000 00000000 00000000 00000000 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 Call trace: [<81a3f8e8>] (rb_erase) from [<80610d54>] (erase_entry fs/proc/proc_sysctl.c:189 [inline]) [<81a3f8e8>] (rb_erase) from [<80610d54>] (erase_header fs/proc/proc_sysctl.c:225 [inline]) [<81a3f8e8>] (rb_erase) from [<80610d54>] (start_unregistering fs/proc/proc_sysctl.c:322 [inline]) [<81a3f8e8>] (rb_erase) from [<80610d54>] (drop_sysctl_table+0xd0/0x1ac fs/proc/proc_sysctl.c:1514) r5:8517c348 r4:8517c300 [<80610c84>] (drop_sysctl_table) from [<80610d88>] (drop_sysctl_table+0x104/0x1ac fs/proc/proc_sysctl.c:1521) r8:00000004 r7:8517c300 r6:00000001 r5:8517cb00 r4:84813a00 [<80610c84>] (drop_sysctl_table) from [<80610e58>] (unregister_sysctl_table fs/proc/proc_sysctl.c:1539 [inline]) [<80610c84>] (drop_sysctl_table) from [<80610e58>] (unregister_sysctl_table+0x28/0x38 fs/proc/proc_sysctl.c:1531) r8:829d1ec4 r7:df9e5e90 r6:829e0224 r5:df9e5e90 r4:84813a00 [<80610e30>] (unregister_sysctl_table) from [<81980b1c>] (unregister_net_sysctl_table+0x10/0x14 net/sysctl_net.c:177) r5:df9e5e90 r4:8517cb00 [<81980b0c>] (unregister_net_sysctl_table) from [<816f45b0>] (sysctl_route_net_exit+0x18/0x38 net/ipv4/route.c:3632) [<816f4598>] (sysctl_route_net_exit) from [<81539cdc>] (ops_exit_list+0x40/0x68 net/core/net_namespace.c:172) r5:df9e5e90 r4:84951b00 [<81539c9c>] (ops_exit_list) from [<8153c160>] (cleanup_net+0x2b0/0x49c net/core/net_namespace.c:654) r7:df9e5e90 r6:829d1e80 r5:82c1f940 r4:829e0224 [<8153beb0>] (cleanup_net) from [<802873bc>] (process_one_work+0x1b4/0x4f4 kernel/workqueue.c:3238) r10:8300f070 r9:8301bc15 r8:84186000 r7:8300e600 r6:8301bc00 r5:829d1e98 r4:83b83d80 [<80287208>] (process_one_work) from [<80288004>] (process_scheduled_works kernel/workqueue.c:3319 [inline]) [<80287208>] (process_one_work) from [<80288004>] (worker_thread+0x1fc/0x3d8 kernel/workqueue.c:3400) r10:61c88647 r9:84186000 r8:83b83dac r7:82804d40 r6:8300e600 r5:8300e620 r4:83b83d80 [<80287e08>] (worker_thread) from [<8028f07c>] (kthread+0x12c/0x280 kernel/kthread.c:464) r10:00000000 r9:83b83d80 r8:80287e08 r7:e4935e60 r6:83b83e00 r5:84186000 r4:00000001 [<8028ef50>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137) Exception stack(0xdf9e5fb0 to 0xdf9e5ff8) 5fa0: 00000000 00000000 00000000 00000000 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:8028ef50 r4:84986300 Code: e5903000 e3530003 9a00001b e3c3c003 (e59c2008) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e5903000 ldr r3, [r0] 4: e3530003 cmp r3, #3 8: 9a00001b bls 0x7c c: e3c3c003 bic ip, r3, #3 * 10: e59c2008 ldr r2, [ip, #8] <-- trapping instruction